CVE-2026-75596

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.137</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is an asynchronous, event-driven network application framework.
	Prior to 4.1.137.Final and 4.2.17.Final, the default
	io.netty.handler.ssl.SniHandler constructors use the pre-handshake
	ClientHello aggregation path in
	handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java
	at io.netty.handler.ssl.SslClientHelloHandler#decode, where
	handshakeBuffer.clear() and writeBytes() recopy all previously
	received body bytes for every additional TLS record. An
	unauthenticated remote peer can advertise a large ClientHello and
	deliver its body in thousands of tiny records, causing quadratic CPU
	work on the event loop before the TLS handshake completes and
	degrading TLS handling for other clients. This issue is fixed in
	versions 4.1.137.Final and 4.2.17.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-75596</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-75596</url>
    </references>
    <dates>
      <discovery>2026-08-19</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>